chore(ci): more generic CRD validation filtering - #23432

Summary by CodeRabbit

• Bug Fixes
  • Security policy exclusions now reject configurations that set both a deployment and an exclusion kind. Either field—or neither—can be specified.
  • Exclusions without a deployment now serialize without an empty deployment field.

The SecurityPolicy API and CRD manifests now restrict each exclusion to at most one of deployment and excludeByKind. The CRD compatibility workflow uses a script that filters this validation from SecurityPolicy CRDs before running crdify.

Changes: SecurityPolicy exclusion validation and CRD compatibility

Layer / File(s)	Summary
Exclusion constraint and serialization config-controller/api/v1alpha1/policy_types.go, config-controller/api/v1alpha1/policy_types_test.go, config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml, image/templates/helm/stackrox-central/internal/config.stackrox.io_securitypolicies.yaml, operator/bundle/manifests/config.stackrox.io_securitypolicies.yaml	The API marker and CRD manifests reject exclusions that set both fields. JSON tests check serialization for kind-only and named-deployment exclusions.
CRD compatibility script .github/workflows/scripts/crdify.sh	The script checks its arguments and input files. For SecurityPolicy CRDs, it filters the matching validation into temporary copies before running crdify.
Workflow integration .github/workflows/check-crd-compatibility.yaml	Both workflow steps enable strict Bash handling and call crdify.sh with absolute CRD paths.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: vladbologa, rhybrillou, clickboo

The compatibility workflow can run as configured, but callers cannot use the script’s documented optional flags. The flag check should be corrected; this does not block the current workflow.

Pre-merge checks: 3 · 1 · 1

Failed checks: 1 warning · 1 inconclusive

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (4 skipped: 4…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check		The description includes the required sections and a basic validation statement, but the main explanation is overly generic and does not describe the CRD validation rule, the omitzero change, or the…	Add a concise summary of the implementation changes, including the AtMostOneOf validation, the Deployment JSON tag change, and the generic crdify filtering script. Update the automated testing checklist to reflect the added unit test …

Passed checks: 3 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly describes the CI change that makes CRD validation filtering more generic. It is concise and related to the primary workflow and script changes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (4 skipped: 4 unsupported.)

Full details: Description check

Explanation

The description includes the required sections and a basic validation statement, but the main explanation is overly generic and does not describe the CRD validation rule, the omitzero change, or the new filtering script. The automated testing checklist also does not identify the added unit test.

Resolution

Add a concise summary of the implementation changes, including the AtMostOneOf validation, the Deployment JSON tag change, and the generic crdify filtering script. Update the automated testing checklist to reflect the added unit test and state which tests were run.

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

@@                    Coverage Diff                    @@
##           boo-add-cr-validation   #23432      +/-   ##
=========================================================
- Coverage                  51.97%   51.96%   -0.01%     
=========================================================
  Files                       2912     2912              
  Lines                     183385   183385              
=========================================================
- Hits                       95307    95302       -5     
- Misses                     79729    79731       +2     
- Partials                    8349     8352       +3     

Flags with carried forward coverage won't be shown. Click here to find out more.

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.